INCIDENT RESPONSE TABLETOP

Incident Response Tabletop Exercises
Rehearse Before It's Real

Most organizations have an incident response plan. Far fewer have tested it. ThreeShield facilitates industry-specific tabletop exercises that reveal the gaps in your plan, clarify decision authority under pressure, and build muscle memory - before a real incident exposes the gaps to an attacker.

What a ThreeShield Tabletop Covers

💣

Ransomware Scenario

Your primary file server is encrypted. Backups may be compromised. You have a ransom demand. Walk through: containment decisions, backup validation, regulatory notification obligations, client communication, ransom payment decision authority, and media handling.

📧

Business Email Compromise

A finance staff member received a convincing invoice request from a "vendor" - and paid it. The vendor's real account was spoofed. Walk through: detection, wire transfer recall procedures, law enforcement notification, and preventive control improvements.

☁️

Cloud Account Takeover

A Microsoft 365 account was compromised. The attacker has had access for 14 days. Email forwarding rules were configured. Client data may have been exfiltrated. Walk through: scope assessment, PIPEDA/HIPAA/HIA notification obligations, evidence preservation, and remediation.

🛢️

OT/ICS Attack (Energy Sector)

An IT-side compromise has spread to OT network. SCADA alarms are triggering. You don't know if operational systems are compromised. Walk through: OT isolation decisions, operational continuity, CER/CCCS notification, and contractor access management.

🏥

Healthcare-Specific Scenarios

EMR unavailability, PHI exposure to unauthorized parties, ransomware during clinical operations. Walk through: clinical downtime procedures, OIPC/OCR notification, patient notification, and media handling with regulatory sensitivity.

🤝

Custom Scenario Development

ThreeShield develops scenarios specific to your organization's risk profile, using your actual technology environment and regulatory obligations as the context. Generic scenarios miss organization-specific gaps.

Required by Many Compliance Frameworks

Tested incident response plans are required by HIPAA, PCI DSS, SOC 2, NERC CIP, CMMC, and most cyber insurance policies. ThreeShield provides post-exercise documentation suitable for compliance evidence.

Frequently Asked Questions

A standard single-scenario tabletop runs 2-4 hours including facilitated debrief. Full-day exercises covering multiple scenarios are available for organizations that want broader coverage. Shorter 90-minute executive-focused versions can be delivered as part of a board or leadership offsite.

The most valuable tabletop exercises include both - decision-makers (executives, legal, communications) who control resources and communicate externally, and technical staff who understand what's actually happening and what's possible. A tabletop where only IT participates misses the governance and communication gaps. A tabletop with only executives misses the technical constraints.

ThreeShield provides a written exercise report documenting: scenario summary, participant decisions at each inject, gaps identified, recommended improvements to the incident response plan, and an attestation letter suitable for insurance and compliance submissions.

Three Ways to Engage - DIY to Done-for-You

ThreeShield meets you at your current security maturity. Every level includes Lavawall®.

Self-Serve

DIY via Lavawall®

For lean IT teams and cost-conscious organizations with internal security capacity

  • Lavawall® GRC with incident response requirements control mapping
  • Continuous automated evidence collection
  • Live compliance dashboard and score
  • Policy template library
  • AI-generated compliance status reports
Start with Lavawall®
Recommended for MSPs & Lean IT

Supported

Expert guidance alongside your team - ideal for MSPs and organizations with some internal IT capacity

  • Everything in DIY tier
  • CISSP/CISA gap assessment
  • Prioritized remediation roadmap
  • Policy and procedure development
  • Quarterly compliance review calls
  • MSP white-label available
Get Supported Engagement
Fully Managed

Done-for-You

Full compliance delivery - ThreeShield manages the entire program end to end

  • Everything in Supported tier
  • Full compliance program management
  • CISSP/CISA-executed formal assessment
  • findings methodology (typically 200+ findings)
  • Complete documentation package
  • Annual reassessment included
Book Done-for-You

Ready to Get Compliant?

Choose your engagement model: DIY via Lavawall®, supported by ThreeShield's CISSP/CISA team, or fully done-for-you. Every model includes continuous monitoring so you stay compliant year-round.

Book a Scoping Call

DIY · Supported · Done-for-You · Available globally